78 lines
2.6 KiB
Terraform
78 lines
2.6 KiB
Terraform
resource "vault_mount" "secret" {
|
|
path = module.config.vault.mount
|
|
type = "kv"
|
|
options = {
|
|
version = "2"
|
|
}
|
|
}
|
|
|
|
resource "vault_policy" "service" {
|
|
for_each = module.config.services
|
|
name = "service-${each.key}"
|
|
policy = jsonencode({
|
|
path = merge(
|
|
{
|
|
"${vault_mount.secret.path}/data/${each.key}/*" = { capabilities = ["read"] }
|
|
},
|
|
{
|
|
for key, access in module.config.service_databases :
|
|
"${module.config.vault.database_mount}/creds/${key}" => { capabilities = ["read"] }
|
|
if access.service == each.key
|
|
},
|
|
)
|
|
})
|
|
}
|
|
|
|
resource "vault_auth_backend" "approle" {
|
|
type = "approle"
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role" "service" {
|
|
for_each = module.config.services
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = each.key
|
|
token_policies = [vault_policy.service[each.key].name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 14400
|
|
secret_id_ttl = 2592000
|
|
}
|
|
|
|
locals {
|
|
kv = vault_mount.secret.path
|
|
db = module.config.vault.database_mount
|
|
ar = vault_auth_backend.approle.path
|
|
|
|
manage = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
resource "vault_policy" "terraform" {
|
|
name = "terraform"
|
|
policy = jsonencode({
|
|
path = {
|
|
"auth/token/create" = { capabilities = ["update"] }
|
|
|
|
"sys/mounts/${local.kv}" = { capabilities = ["read"] }
|
|
"sys/mounts/auth/${local.ar}" = { capabilities = ["read"] }
|
|
"sys/mounts/auth/${local.ar}/tune" = { capabilities = ["read"] }
|
|
"sys/policies/acl/service-*" = { capabilities = local.manage }
|
|
"sys/policies/acl/terraform" = { capabilities = ["read", "update"] }
|
|
"auth/${local.ar}/role/+" = { capabilities = local.manage }
|
|
"auth/${local.ar}/role/+/role-id" = { capabilities = ["read"] }
|
|
"auth/${local.ar}/role/+/secret-id" = { capabilities = ["update"] }
|
|
|
|
"${local.kv}/data/+/s3" = { capabilities = local.manage }
|
|
"${local.kv}/data/+/postgres/+" = { capabilities = local.manage }
|
|
"${local.kv}/metadata/+/s3" = { capabilities = ["read", "update", "delete"] }
|
|
"${local.kv}/metadata/+/postgres/+" = { capabilities = ["read", "update", "delete"] }
|
|
|
|
"sys/mounts/${local.db}" = { capabilities = ["read"] }
|
|
"sys/mounts/${local.db}/tune" = { capabilities = ["update"] }
|
|
"${local.db}/config" = { capabilities = ["list"] }
|
|
"${local.db}/config/postgres" = { capabilities = ["read", "update"] }
|
|
"${local.db}/roles/+" = { capabilities = local.manage }
|
|
|
|
"sys/storage/raft/snapshot" = { capabilities = ["read"] }
|
|
}
|
|
})
|
|
}
|